CVE-2023-36827

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal (directory traversal) vulnerability affects fides versions lower than version `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. The vulnerability is patched in fides `2.15.1`. If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error. Additionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.

• CWE-22

• https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811fPatch
• https://github.com/ethyca/fides/releases/tag/2.15.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hqMitigation, Third Party Advisory
• https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811fPatch
• https://github.com/ethyca/fides/releases/tag/2.15.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-r25m-cr6v-p9hqMitigation, Third Party Advisory

Published

Jul 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36821Uptime Kuma, a self-hosted monitoring tool, allows an authen…8.8
• CVE-2023-36822Uptime Kuma, a self-hosted monitoring tool, has a path trave…8.1
• CVE-2023-36823Sanitize is an allowlist-based HTML and CSS sanitizer. Using…6.1
• CVE-2023-36824Redis is an in-memory database that persists on disk. In Red…8.8
• CVE-2023-36825Orchid is a Laravel package that allows application developm…9.8
• CVE-2023-36826Sentry is an error tracking and performance monitoring platf…6.5
• CVE-2023-36828Statamic is a flat-first, Laravel and Git powered content ma…5.4
• CVE-2023-36829Sentry is an error tracking and performance monitoring platf…5.4
• CVE-2023-3683A vulnerability has been found in LivelyWorks Articart 2.0.1…5.4
• CVE-2023-36830SQLFluff is a SQL linter. Prior to version 2.1.2, in environ…7.8
• CVE-2023-36831An Improper Check or Handling of Exceptional Conditions vuln…7.5
• CVE-2023-36832An Improper Handling of Exceptional Conditions vulnerability…7.5